Privacy Policy

Information on Personal Data Processing

Personal Data Controller Stoklasa Textile Haberdashery Ltd. with its registered office at Průmyslová 934/13, 747 23 Bolatice, ID 25877666 (hereinafter referred to as "Controller") provides, in accordance with Article 12 et seq. regulation of the data subjects listed below on the processing of personal data.

Data Subject - a natural person whose personal data is processed by an administrator (e.g., e-shop visitors, registered e-shop customers, loyalty program members, employees).

If necessary, data subjects may contact the Controller at the following contacts:

• mailing address: Stoklasa textilní galanterie s.r.o., Průmyslová 934/13, 747 23 Bolatice Czech Rep.
  
• data mailbox address: yw64u99
• e-mail address: gdpr@stoklasa.cz
• phone: (+420) 228 229 395, Mon - Su: 7:00 - 18:00

The processing of personal data is done especially for the purpose of registering e-shop customers, fulfilling the contract, registering bonus programs for merchants and marketing purposes (sending electronic newsletters with news and special offers, sending a birthday / holiday wish with a discount coupon, online ads, customer reviews of e-shop).

The processing of personal data based on the legal basis of the processing referred to in Article 6 (1) f) The Controller strictly observes the defense of its legal claims in the performance of tasks related to the sale of goods at the e-shop www.stoklasa.cz and its language mutations. The processing of personal data based on the consent of the data subject for direct marketing purposes is used to inform our customers about news, events and good tips through a newsletter or text message. The processing of personal data on the basis of the data subject's consent (eg. date of birth, e-mail address) is done solely for the purpose of the expressed consent with which the data subject is always informed prior to his / her grant.

EU GDPR Lawfulness of processing in Art. 6 (1) 1a, 1b a 1f.

The Collector processes the following categories of personal information:

• E-shop customer identification data, to the extent required by applicable law or to contact them (name, surname, company name, ID, VAT ID, date of birth, address (billing, delivery, telephone, e-mail) , personal data expressed in the data subject's agreement with the processing of personal data (date of birth).
• Personal data is retrieved from the data subject, from public sources (such as the Business Register, ARES - in particular to verify the accuracy of personal data already processed) and from other sources.
  The recipients of personal data are subjects to which the trustee is obliged to provide personal data on the basis of the relevant generally binding legal regulations, the entities with which the trustee cooperates (foreign e-shop managers, Stoklasa contract store operators, external on-line marketing services) or other authorized entities with regard to specific processing. The recipient of personal data are not subjects whose activity is not related to the activities and services provided by the controller, unless the data subject agrees with it.

The controller intends to pass personal data to third countries and international organizations (foreign customers are handled by managers for foreign countries, we use external advertising systems that can be based abroad for marketing purposes). Information about the protection of personal data, the existence of appropriate safeguards and places of access to personal data will be provided by the controller on the above mentioned contacts.

Personal data are stored for as long as the relevant generally binding legal regulations lay down if such processing is imposed or allowed. In other cases, the period of storage of personal data is set as the time required to exercise the rights or legitimate interests of the data subject, the controller or third parties or as the time required to defend the legal rights of the controller, third parties. The period of personal data storage also sets out the relevant requirements of European Union rules, particularly in the area of subsidies. When determining the length of time for the storage of personal data, all aspects of that processing and the interests of the data subject are taken into account. We will manage your personal data obtained from our data subject's consent for 10 years or until your consent is withdrawn.

In cases where the processing of personal data is based on the fulfillment of legal obligations and their provision is a legal requirement, the data subject is obliged to provide personal data. In the case of non-disclosure of personal data, the statutory requirements can not be fulfilled, which may lead to the failure of the performed actions. If the provision of personal data is a contractual requirement or a requirement to be included in the contract (and is not a fulfillment of legal obligations), in the case of refusal, personal data may be provided by the data subject to a situation where the contract can not be concluded. However, the trustee does not make the conclusion of a contract subject to the provision of personal data by the data subject that is not necessary for the proper conclusion of the contract.

There is no automated decision making in the processing of personal data. Profiling is not used by the controller.

The controller does not process personal data directly communicated by the data subject for purposes other than those communicated to the data subject at the time of handover. If the controller intends to process such personal data for other purposes, it will provide the data subject with information about that other purpose, as well as other information necessary to exercise his / her rights, before commencing processing.

The data subject also has the following rights:

• In cases where the processing is based on Article 6 (1) (a) The Regulation or Article 9 (2) (a) The Regulation, ie the processing of personal data, is carried out with the consent of the data subject, the data subject has the right to withdraw consent at any time without prejudice to the lawfulness of the processing based on the consent given prior to his recall.
  Submit a complaint to the Supervisory Authority.
• Under Article 15 of the Regulation, the right of access to personal data and the right to obtain from the controller a confirmation that the personal data concerning him / her are processed or not and, if so, has the right to have access to these personal data and information about their processing.
• Pursuant to Article 16 of the Regulation, the Collector is entitled to correct inaccurate personal data relating to him / her or to supplement incomplete personal data without undue delay.
• The right to delete the personal data relating to the data subject without undue delay under the conditions set out in Article 17 of the Regulation.
• The right to limit the controller to the processing of his or her personal data under the conditions set forth in Article 18 of the Regulation.
  If the data subject so requests, the trustee is required to inform the data subjects' data subject pursuant to Article 19 of the Regulation.
• Under the conditions set out in Article 20 of the Regulation, it is to obtain personal data concerning it which it has provided to the controller in a structured, commonly used and machine-readable format and the right to pass this information to another controller.
  Subject to the conditions set out in Article 21 of the Regulation at any time, to object to the processing of personal data concerning it.
• Under the conditions set out in Article 22 of the Regulation, no decision is to be made solely on automated processing, including profiling, which has legal effects or has a significant effect on it.
• The controller must, in accordance with Article 34 (1) of the Data Submission Regulation, notify the case of a breach of security of his or her personal data, resulting in a high risk for his rights and freedoms. This obligation does not apply to the trustee if any of the conditions set out in Article 34 (3) of the Regulation apply.
• The Right at any time to refuse to send business communications via a link in a commercial message, or by sending a message to any of the contacts listed in the introduction to this document. The terms and conditions for the sending of commercial communications are regulated in more detail by the provisions of Section 7 of Act No. 480/2004 Coll., On Certain Information Society Services and on Amendments to Certain Acts (Act on Some Information Society Services), as amended.
•  

The Privacy Policy has been in force since October 31, 2019.